From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Tosatti Subject: cirrusfb division by zero Date: Wed, 30 Apr 2008 13:36:40 -0300 Message-ID: <20080430163640.GB25309@dmt> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: kvm-devel To: Anthony Liguori , Alan Pevec Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces@lists.sourceforge.net Errors-To: kvm-devel-bounces@lists.sourceforge.net List-Id: kvm.vger.kernel.org Anthony, The following sequence crashes F9 guests, when using VNC: # modprobe cirrusfb # vbetool post Results in Floating point exception at: cirrus_do_copy() { depth = s->get_bpp((VGAState *)s) / 8 ... sx = (src % (width * depth)) / depth; ... } Problem is that ->get_bpp returns 0. Following band-aid "fixes it" (coff). I have no idea if its correct though ? "vbetool post" corrupts both SDL and VNC displays when using cirrusfb, but seems a separate problem. diff --git a/qemu/hw/cirrus_vga.c b/qemu/hw/cirrus_vga.c index e14ec35..9f860ff 100644 --- a/qemu/hw/cirrus_vga.c +++ b/qemu/hw/cirrus_vga.c @@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in int notify = 0; depth = s->get_bpp((VGAState *)s) / 8; + if (!depth) + depth = 1; s->get_resolution((VGAState *)s, &width, &height); /* extra x, y */ ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Don't miss this year's exciting event. There's still time to save $100. Use priority code J8TL2D2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone